Document NixOS as a supported OS for the Smallstep Agent

[joshdrake]

Describe your changes:

Closes OFF-13.

The step-agent package was upstreamed to nixpkgs, but it ships only the binary. Everything agent/extra/step-agent.postinst does on Debian and RPM — system user, systemd unit, tmpfiles, polkit rules, tss group, p11-kit module registration — has no equivalent on NixOS, because there is no services.step-agent module yet (OFF-2). So a NixOS admin currently has no path from "install the package" to "enrolled device".

platform/smallstep-agent.mdx

• NixOS added to the supported-OS list under System requirements → Linux.
• New NixOS section under Manual install, carrying the full interim configuration — ported field-for-field from agent/extra/ — plus an unstable overlay for stable-channel users and the register step.
• NixOS notes in Start the agent, the Chrome PKCS#11 example, and Uninstall.

platform/troubleshooting-agent.mdx — the two genuine NixOS deltas in the Linux platform reference (no /usr/bin/step-agent; doctor reports p11-kit missing without an explicit store path).

step-cli/installation.mdx — separate commit dropping a channel=20.09 pin from the NixOS search link, which had gone dead.

Two limitations are stated plainly in the docs rather than papered over:

• The package is on nixos-unstable only — it merged after the 26.05 branch-off, so the first stable NixOS release carrying it is 26.11.
• Hosts without a hardware TPM cannot enroll: the swtpm-setup / swtpm-certcreate helpers the .deb ships are not part of the nixpkgs package, and the EK cert they mint identifies the software TPM to the attestation CA, so it is not something an operator can hand-roll from the docs.

Verified

• pkgs.step-agent builds from nixos-unstable and ./result/bin/step-agent version runs — the documented version output is its real output.
• The configuration.nix snippet evaluates through nixosSystem, and the rendered step-agent.service matches agent/extra/step-agent.service directive for directive.
• The overlay snippet resolves pkgs.step-agent on a stable channel with no eval warnings.
• ${pkgs.p11-kit}/lib/pkcs11/p11-kit-client.so exists, and NixOS's p11-kit does read /etc/pkcs11/modules (confirmed against the compiled-in config path), so the environment.etc registration takes effect.
• nixpkgs#489756 (tss must be a system group) is closed, so no workaround is documented.
• Vale and markdown-link-check are clean — Vale output is byte-identical to the pre-change baseline (the 5 pre-existing Google.EmDash errors are untouched).

Not verified: none of this proves the agent actually enrolls end to end on a real NixOS host with a hardware TPM. That needs a NixOS machine or the VM test from OFF-4. Worth having Diego or Kylian at BSI run the recipe before this merges, since they have NixOS fleets in production.

Related links/other PRs/issues:

Gaps found during this work, filed as follow-ups: OFF-14 (stable-channel backport), OFF-15 (release-process version bump), OFF-16 (package metadata). Existing coverage: OFF-2 (module), OFF-3 (declarative enrollment), OFF-4 (VM test), OFF-5 (PKCS#11), OFF-6 (derivation hardening), OFF-8 (license sign-off).

🤖 Generated with Claude Code

https://claude.ai/code/session_01KSuffpV7e9tawW249FA7gN

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}